SonicWall SonicOS

Transcription

1 SonicWall SonicOS February 2017 These release notes provide information about the SonicWall SonicOS release. Topics: About SonicOS Supported Platforms New Features Resolved Issues Known Issues System Compatibility Product Licensing Upgrading Information SonicWall Support About SonicOS SonicWall SonicOS provides important new features and fixes many known issues found in previous releases. For more information, see the New Features and Resolved Issues sections. Supported Platforms SonicOS is supported on the following SonicWall appliances: SuperMassive 9600 NSA 6600 TZ600 SuperMassive 9400 NSA 5600 TZ500 / TZ500 Wireless SuperMassive 9200 NSA 4600 TZ400 / TZ400 Wireless NSA 3600 TZ300 / TZ300 Wireless NSA 2600 SOHO Wireless 1

2 New Features This section describes the new features introduced in SonicOS Topics: High Availability PPPoE Unnumbered Interface Support Vendor OUI Detection and Logging Dell X Series Switch Integration Features DPI SSH Support for pcapng TSR FTP for Periodic Backup Custom Lists for Geo IP and Botnet SIP UDP Fragmentation Fixes System Logs on AppFlow Server via IPFIX NAT64: Stateful NAT from IPv6 Client to IPv4 Server DNS Proxy FQDN Routing Maximum Routes Doubled Maximum Zone to Zone Access Rules Increased Flow Reporting using IPFIX Extension Version 2 Syslog Server Profiling IPv6 Support DPI SSL Increased Connection Counts and Enhancements Open Authentication Social Login SonicPoint Radius Accounting 31 Bit Network RESTful API Biometric Authentication EasyVPN High Availability SonicOS introduces two new features in the area of High Availability: HA support with Dynamic WAN interfaces In SonicOS , PPPoE can be enabled on interfaces in HA Active/Standby mode. After the active unit connects to the PPPoE server, it synchronizes the PPPoE session ID and server name to the idle unit. During a failover, the active unit terminates the PPPoE HA connection on the client side by timing out. The secondary unit then terminates the original connection on the server side and starts a new PPPoE connection. 2

3 When High Availability is enabled and one interface is configured as PPPoE Unnumbered, the following settings are required: In the High Availability > Settings screen: Select the Enable Virtual MAC checkbox Clear the Enable Preempt Mode checkbox In the High Availability > Monitoring screen: Select Enable Physical/Link Monitoring Set the Primary and Secondary IP address fields to Clear all other checkboxes HA Stateful Synchronization support for DHCP DHCP can now be enabled on interfaces in HA mode. This feature is supported in both Active/Standby (non stateful) and Stateful Synchronization mode. Only the active unit can get a DHCP lease. It synchronizes the DHCP IP address along with the DNS and gateway addresses to the idle unit. The DHCP client ID is also synchronized, allowing this feature to work even without enabling Virtual MAC. During a failover, the active unit releases the DHCP lease and the secondary unit renews the DHCP lease using the existing DHCP IP address and client ID as it becomes the active unit. The IP address does not change, and network traffic, including VPN tunnel traffic, continues to pass. If the active unit does not have an IP address when failover occurs, the secondary unit starts a new DHCP discover. PPPoE Unnumbered Interface Support A PPPoE Unnumbered interface allows you to manage a range of IP addresses with only a single PPPoE connection. The Internet Service Provider (ISP) provides multiple static IP addresses that can be allocated within a subnet. The first address is designated as the network address, and the last one as the broadcast address. 3

4 Start by configuring the PPPoE client settings on a WAN interface: The Unnumbered PPPoE interface is configured on a different interface: 1 For Zone, select LAN, DMZ, or create a new zone. 2 For Mode / IP Assignment, select IP Unnumbered. 3 For IP Address, enter the address provided by your ISP. Usually it is the second IP address assigned by the provider. The subnet mask is also assigned by the ISP. Notes: The default MTU of PPPoE is To change X3 to another mode when X2 unnumbered to X3 is configured, first terminate the relationship with X2 by changing X2 to another mode. Otherwise, if you change the IP address or mask of interface X3, it causes X3 to reconnect to the PPPoE server. If X3 is set as unnumbered interface, other interfaces cannot connect to X3 using an L2 Bridge. 4

5 If High Availability is enabled, High Availability > Settings is configured as shown below with Unnumbered PPPoE: A sample network topology is shown below: In this topology, X2 is the PPPoE unnumbered interface and X3 is an unnumbered interface. SonicOS adds two routes: 5

6 SonicOS also adds two NAT policies: A manually added NAT policy would have settings such as: Vendor OUI Detection and Logging Every wired or wireless networking device has a 48 bit MAC address assigned by their hardware manufacturers. An organizationally unique identifier (OUI) is a 24 bit number that uniquely identifies a vendor, manufacturer, or other organization globally or worldwide. The first three octets of the MAC address are the OUI. In SonicOS , this information is used to provide a Vendor column in the following tables: Dashboard > Connections Monitor Dashboard > Log Monitor Dashboard > AppFlow Monitor Network > ARP Network > Neighbor Discovery Network > MAC IP Anti spoof Network > DHCP Server Network > IP Helper Switching > L2 Discovery Switching > Link Aggregation VPN > DHCP over VPN Wireless > Status 6

7 Wireless > IDS SonicPoint > Station Status SonicPoint > RF Analysis SonicPoint > IDS Dell X Series Switch Integration Features SonicOS provides several enhancements and new features for Dell X Series integration: PortShield and High Availability Dell X Series integration previously supported SonicOS PortShield functionality in HA mode using Dedicated Uplink(s). In SonicOS , support for PortShield functionality in HA mode is available using Common Uplink. In this configuration, a link between the active/standby firewall and the X Series switch serves as a common uplink to carry all the PortShield traffic. In this configuration firewall interfaces which serve as PortShield hosts should be connected to a separate switch and not the same X Series switch connected to the active and standby units. This is to avoid looping of packets for the same PortShield VLAN. The PortShield members can be connected to ports on the X Series switch which is controlled by the active/standby firewall. Single Point of Management over Common Uplink for VLAN Traffic Dell X Series integration previously supported VLANs in a Dedicated Uplink configuration. In SonicOS , VLANs are also supported with Common Uplink. This allows a single link between the firewall and the X Series switch to carry management traffic of the firewall managing the X Series switch plus PortShield traffic for the Interface Disambiguation via VLAN (IDV) VLANs corresponding to the firewall interfaces plus traffic for the VLAN sub interfaces present under the Common Uplink interface. NOTE: Overlapping VLANs cannot exist under appliance interfaces configured as dedicated uplinks or common uplinks to the same switch. This is because the VLAN space is global on the X Series switch. NOTE: PortShield of Extended Switch Interfaces to Common Uplink Interfaces without selecting any VLANs for access/trunk configuration is not supported. Increase X Series Switch Maximum to Four In previous SonicOS releases, a SonicWall firewall could be provisioned for a maximum of two X Series switches. In SonicOS , a maximum of four X Series switches is supported. All four X Series switches must be directly connected to the firewall appliance. Daisy chaining of X Series switches is not yet supported. Support for SonicWall NSA and SuperMassive In SonicOS , support for the X Series solution is extended to include SonicWall NSA and SuperMassive appliances, with the exception of the NSA The following SonicWall platforms are now supported: SuperMassive 9600 NSA 6600 TZ600 SuperMassive 9400 NSA 5600 TZ500 / TZ500 Wireless SuperMassive 9200 NSA 4600 TZ400 / TZ400 Wireless NSA 3600 TZ300 / TZ300 Wireless 7

8 DPI SSH SonicOS introduces the DPI SSH feature. DPI SSH inspects the data traversing the firewall in an SSH tunnel. SSH, or Secure Shell, is a cryptographic network protocol for secure network communication and services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH server and SSH client programs, respectively. SSH is not only a shell, but acts as a secure channel. It can provide different services over this tunnel, including shell, file transfer or X11 forwarding. SonicOS supports SSH2. SSH1 sessions will not be intercepted and inspected. If the SSH1 banner message contains a non conforming SSH version number, it will be treated as a bad protocol and dropped. DPI, or Deep Packet Inspection, examines the data part (and possibly also the header) of a packet as it passes the SonicWall firewall. It searches for protocol non compliance, viruses, spam, intrusions, or defined criteria to decide whether the packet may pass. DPI SSH decrypts incoming SSH packets and sends them to the DPI module for inspection. After completion of DPI inspection, it re encrypts the packet again and sends the packet to the destination. If the data/packet does not pass the DPI inspection, DPI SSH resets the connection. DPI SSH provides inclusion/exclusion criteria to inspect or bypass certain kinds of traffic. The SonicOS administrator can modify the criteria on the DPI SSH > Configure screen. DPI SSH supports both route mode and wire mode. For wire mode, DPI SSH is only supported in the secure (active DPI of inline traffic) mode. For route mode, there is no limitation. DPI SSH supports the following clients: SSH client for Cygwin Putty securecrt SSH on Ubuntu SSH on centos SFTP client for Cygwin SCP on Cygwin Winscp DPI SSH supports the following servers: SSH server on Fedora SSH server on Ubuntu DPI SSH supports the following key exchange algorithms: Diffie hellman group1 sha1 Diffie hellman group14 sha1 ecdh sha2 nistp256 Notes: If there is already an SSH server key stored in the local machine, it must be deleted. For example, if you already SSH to a server, and the server DSS key is saved, the SSH session will fail if the DSS key is not deleted from the local file. The ssh keygen utility cannot be used to bypass the password. Putty uses GSSAPI. This option is for SSH2 only, which provides stronger encrypted authentication. It stores a local token or secret in the local client and server for the first time communication. It exchanges messages and operations before DPI SSH starts, so DPI SSH has no knowledge about whatever was exchanged before, including GSSAPI token. DPI SSH will fail with the GSSAPI option enabled. 8

9 On the client side, either the SSH 2.x or 1.x client can be used if DPI SSH is enabled. However, clients with different version numbers cannot be used at the same time. Gateway Anti Spyware and Application Firewall inspections are not supported even if these options are selected in the DPI SSH > Configure screen. Support for pcapng SonicOS provides an option to export the pcapng file on the packet monitor user interface. The pcapng file can be directly opened by Wireshark and the new Packet comments section is displayed. In previous releases, packet monitor export supports pcap, but the administrator must export pcap, HTML and text to find out the line number, in interface, out interface, and the function name which acted on the packet. This data is now available by exporting a single pcapng file. The Dashboard > Packet Monitor screen provides a new option to export the pcapng file. When the file is opened in Wireshark, the new Packet comments section is displayed. 9

10 TSR FTP for Periodic Backup This feature allows administrators to send the configuration settings (prefs) and tech support report (TSR) to a specified FTP server. Admins can configure a schedule for periodic backup of this information to the FTP server. To enable scheduled prefs and TSR backups: 1 Navigate to the System > Settings page. 2 Click the Send by FTP button. The Schedule Reports page displays. 3 Select the Send Tech Report by FTP checkbox to send TSR. 4 Select the Send Settings by FTP checkbox to send prefs. 5 Enter the required information for the FTP server. 6 Click the Set Schedule button to define a start schedule. 7 Click OK and then click Apply. Custom Lists for Geo IP and Botnet SonicOS provides new options to configure a custom country list for Geo IP Filter and a custom botnet list for Botnet Filter. An IP address can be associated with a wrong country. This kind of misclassification can cause incorrect/unwanted filtering of an IP address. Having a custom country list can solve this problem. The custom country list overrides the firewall country associated with a particular IP address. Similarly, an IP address can be wrongly marked as botnet. A custom botnet list can override the botnet tag for a particular IP address. 10

11 The Security Services > Geo IP Filter page is changed for this new feature, and has four tabs with various configuration settings on each. The Security Services > Botnet Filter page is similarly changed for this new feature, also with four tabs. SIP UDP Fragmentation Fixes In previous releases, the SIP transformation design and implementation does not handle fragmented SIP packets transported in UDP mode. A SIP/UDP signaling packet is fragmented when the SIP payload length is greater than the maximum MTU size of the network minus the size of the SIP packet headers. For example, for a commonly accepted maximum MTU size of 1514 bytes, if the SIP signaling packet payload length exceeds 1472 bytes, the SIP packet is dropped by SonicOS. In SonicOS , SIP/UDP payload length is not restricted by the underlying MTU size on the network. This support is completely transparent to users. No configuration is required. 11

12 System Logs on AppFlow Server via IPFIX In SonicOS , system logs can be sent to an external server via IPFIX packets and then saved into the database on the disk. The logs only include the ones which are reported WITHOUT connection cache. Users can edit the configuration in the Log > Settings page to indicate which log events should be sent. System logs include events that are typically not dependent on traffic flowing through the firewall. Such events are mostly flow (session/connection) related events. System logs typically include, but are not limited to: Interface state change Fan failure User authentication HA failover and failback Tunnel negotiations System events such as configuration changes Configuration options for this feature are on these pages: AppFlow > Flow Reporting > External Collector tab: An important step is send log properties and some fields of log settings to the external collector. Make sure the connection between SonicOS and the external collector server is ready before clicking the Send All Entries button to send the settings. 12

13 Click the button again to sync the settings in the following cases: SonicOS is upgraded with some NEW added log events. The connection between SonicOS and the external server has been down for some time and log settings might have been edited in the period. AppFlow > Flow Reporting > GMSFlow Server tab: Enable Logs in the Include Following Additional Reports via IPFIX drop down list. Click the Synchronize Log Settings button when ready. AppFlow > Flow Reporting > AppFlow Server tab: Enable Logs in the Include Following Additional Reports via IPFIX drop down list. Click the Synchronize Log Settings button when ready. NAT64: Stateful NAT from IPv6 Client to IPv4 Server As a NAT64 translator, SonicOS allows an IPv6 only client from any zone to initiate communications to an IPv4 only server with proper route configuration. It maps IPv6 addresses to IPv4 addresses so that IPv6 traffic changes to IPv4 traffic and vice versa. IPv6 address pools (represented as Address Objects) and IPv4 address pools are created to allow the mapping. An IP/ICMP translation algorithm is implemented to translate packet headers between IPv6 and IPv4. The IPv4 addresses of IPv4 hosts are translated to and from IPv6 addresses by using an IPv6 prefix configured in SonicOS. A DNS64 server is configured in the IPv6 only client, which creates AAAA records (IPv6 records) with A records (IPv4 records). SonicOS does not act as a DNS64 server. This feature provides a way for administrators to configure a NAT64 policy in the same way as a regular NAT policy. In the policy, by configuring translated destination to Original in a 6to4 policy, SonicOS will automatically translate IPv4 converted IPv6 addresses to IPv4 addresses. When adding a policy from the Network > NAT Policies page, select NAT64 Only for the IP Version field. 13

14 In SonicOS, an Address Object of Network type can be configured to represent all addresses with pref64::/n to represent all IPv6 client which can do NAT64. Pref64::/n defines a source network which can go from an IPv6 only client through NAT64 to an IPv4 only client. A well known prefix, 64:ff9b::/96, is auto created by SonicOS. Packets from an IPv6 client are originally from the LAN zone, but appear to be from the WAN zone after being translated by the NAT64 policy. To prevent SonicOS from dropping these packets in some cases, a new WAN to WAN allow rule policy should be created, such as: Notes: NAT64 currently only translates unicast packets carrying TCP, UDP, and ICMP traffic. NAT64 currently supports FTP and TFTP application layer protocol streams. It currently does not support the H.323, MSN, Oracle, PPTP, RTSP, and RealAudio application layer protocol streams. NAT64 currently does not support IPv4 initiated communications to a subset of IPv6 hosts. 14

15 DNS Proxy SonicOS supports DNS proxy to allow IPv4 clients to access DNS services in a network with mixed IPv4 and IPv6. In a normal deployment, an IPv4 interface can do name resolution on IPv4 internet, and an IPv6 interface can only do name resolution on IPv6 internet through DNS proxy. A new page is added to the SonicOS web management interface, Network > DNS Proxy. Select the Enable DNS Proxy checkbox to globally enable the feature. There are two modes for DNS proxy: IPv4 to IPv4, and IPv4 to IPv6. The default mode is IPv4 to IPv6, meaning that the firewall redirects queries from clients to upstream IPv6 DNS servers. For IPv4 to IPv4, the firewall redirects the queries to upstream IPv4 DNS servers. Default option on DNS proxy protocol is UDP and TCP, which means when DNS query is sent over TCP, it will be proxied and retransmitted to outside DNS servers over TCP. The checkbox Enforce DNS Proxy For All DNS Requests is an enhanced option for DNS proxy. When the option is selected, other types of DNS queries will be hooked by the DNS proxy module, including stack DNS packets sent by SonicOS, and forwarding DNS queries with destination address of outside DNS servers. Interface Configuration and Allow Rules SonicOS supports the DNS proxy feature on physical interface, VLAN interface, or VLAN trunk interface, and the zone for each interface can only be LAN, DMZ or WLAN. In the Advanced tab of the interface configuration page, there is a checkbox named Enable DNS Proxy when the interface permits configuring DNS proxy. When DNS proxy is enabled on an interface, one Allow Rule is auto added by SonicOS for UDP with the settings: From the interface to the interface, source with any and destination with the interface IP, service with DNS, and enable management. When DNS Proxy over TCP is enabled, another Allow Rule is auto added. 15

16 DHCP When DNS proxy is enabled on an interface, the device needs to push the interface IP as DNS server address to clients, so the SonicOS administrator needs to configure the DHCP server manually and use the interface address as the DNS Server 1 address in the DHCP server settings on the DNS/WINS tab. The Interface Prepopulate check box in the DHCP page makes this easy to configure; if the selected interface has enabled DNS proxy, the DNS server IP is auto added into the DNS/WINS page. DNS Cache In the Network > DNS Proxy page, the DNS Cache function can be enabled by selecting the Enable DNS Cache checkbox; the default setting is enabled. When enabling the function, SonicOS caches the answers from DNS responses during the DNS Proxy process, and will directly respond to clients if a subsequent DNS query matches the DNS cache. There are two kinds of DNS cache: static DNS cache and dynamic DNS cache. Static DNS cache means that it can be manually created and edited by users, and never expires. Dynamic DNS cache is added automatically during the DNS proxy process, and it is displayed only in the whole DNS cache table. Its type is Dynamic, and has TTL value. Dynamic DNS cache can be flushed by the administrator. Split DNS Split DNS is an enhancement for DNS proxy, which allows the administrator to configure a set of name servers and associate them to a given domain name (can be wildcard). When SonicOS receives a query that matches the domain name, it will be transmitted to the designated DNS server. FQDN Routing SonicOS introduces Fully Qualified Domain Name (FQDN) support in Policy based routing (PBR). The FQDN can be used as the source or destination of the PBR entry, and the PBR entry can be redistributed to advanced routing protocols. Policy based routing is a technique used to make routing decisions based on policies set by the network administrator. Policy based routing may be based on the size of the packet, the source address, the protocol of the payload, or other information available in a packet header or payload. The FQDN is added as an address object, which can then be used when configuring the policy. The FQDN object can contain both IPv4 and IPv6 hosts; the number of hosts in an FQDN object is variable. To configure an FQDN address object, select FQDN in the Type field and fill in the other fields. 16

17 Maximum Routes Doubled This feature doubles the maximum number of static and dynamic routes supported by SonicOS. All platforms should maintain reasonable performance while adapting to dynamic routing changes when the maximum number of dynamic and static routes has been exploited. The SonicOS web management interface might respond more slowly during the adaptation period. The TSR displays the maximum static and dynamic routes. Maximum Zone to Zone Access Rules Increased Previous versions of SonicOS do not allow the administrator to increase or decrease the Rule Table size. The Rule Table size for all the Zone Zone pairs is fixed to a constant value based on the platform. SonicOS allows flexible Rule Table size for every Zone Zone pair. The Firewall > Access Rules page is refreshed and has a layout similar to the Firewall > Address Objects page. The selected Zone Zone rule table size is configured on the Firewall > Access Rules page. Maximum Policies Platform SuperMassive 9200/9400/9600 NSA 2600/3600/4600/5600/6600 TZ 300/400/500/600 Series SOHO Wireless Max Size per Zone Zone Rule Table 5000 rules 2500 rules 1250 rules 250 rules Flow Reporting using IPFIX Extension Version 2 SonicOS introduces support for IPFIX with Extension v2. The flow reporting format to the GMS Flow Server (collector) in earlier SonicOS versions uses the IPFIX with Extension format (version 1) by default. In SonicOS 6.2.7, you can customize flow reporting to report in either IPFIX with Extension (v1) or IPFIX with Extension v2. The new format uses variable length fields, which is much more memory efficient than sending static fields and will vastly reduce the amount of information transmitted over the network. In IPFIX with Extension v2, many new fields have been added to convey more information about the firewall, and some redundant or unnecessary fields have been removed. The additional data in these new fields will enrich the GMS Flow Server s visualization capabilities. The GMS Flow Server supports the IPFIX with Extension v2 format beginning in SonicWall GMS 8.3. SonicWall GMS 8.2 or earlier releases only support the IPFIX with Extension (v1) format. The administrator can select IPFIX with Extension v2 for the GMS FS Reporting Format option in the AppFlow > Flow Reporting page, GMSFlow Server tab. A similar option is added on the AppFlow Server tab. To see these fields, you must enable an internal setting. Contact SonicWall Support for information about how to enable this. See support for Support phone numbers. Syslog Server Profiling This feature provides the ability to configure the settings for each Syslog server independently instead of using the global settings for all the servers. In previous releases, the events generated from all the modules in the system are reported to all the configured Syslog servers. Depending on the deployment, this generates a huge amount of Syslog traffic and can cause performance issues or even packet loss. With Syslog Server Profiling, the following new functionality is available: Syslog messages can be sent using different settings for different Syslog servers 17

18 There can be multiple groups of Syslog servers Different events can be configured to be reported to different groups of Syslog servers All the settings in the Log > Syslog page except the Enable NDPP Enforcement for Syslog Server checkbox can now be configured for each row independently in the Syslog Servers table. This allows the Syslog messages to be rendered with different settings for different servers and each server can have its own Rate Limiting options. The newly added Enable checkbox can be used to enable or disable sending of Syslog messages to a specific Syslog server. The settings for Enhanced Syslog and ArcSight format can also be configured individually and the corresponding buttons are shown in the Log > Syslog page. All these settings can be configured from the SonicOS web interface and from the command line interface (CLI.) For convenience, the global settings can be used to configure all servers. NOTE: The Override Syslog Settings with Reporting Software Settings option has been removed. Since the Syslog servers can have their own independent settings, this option is no longer needed. Event Profile The Event Profile is an integer and can range from 0 to 23. It can be used to combine multiple Syslog servers into a group. All Syslog servers in the group have the same Profile. There can be a maximum of 24 groups (0 to 23) and seven Syslog servers per group. Therefore, in total there can be a maximum of 168 Syslog servers. A new column called Event Profile is added to the Syslog Servers table. This new field also belongs to the group key in addition to server name and port. So, instead of <Name, Port>, a <Name, Port, Profile> combination must be unique for each row in the Syslog Servers table. This allows multiple rows to have same <Name, Port> combination with different Profiles. This means one Syslog server can be part of multiple groups, if necessary. The events in the Log > Settings page also have a configurable Event Profile. The Event Profile of an event can be set to any available group, causing the Syslog messages for that event to be sent only to that group of servers. If the Event Profile of an event is set to a group that does not exist in the Syslog Servers table, then no Syslog messages for that event are sent. GMS The GMS server has a fixed Syslog Facility (Local Use 0), Syslog Format (Default), and Server ID (firewall). Although the Event Profile value for GMS is set to 0 by default, all events are reported to GMS irrespective of the profile. GMS is also exempted from Rate Limiting. The newly added Enable checkbox does not apply. GMS can be enabled/disabled only in the System > Administration page and not in the Log > Syslog page. When GMS is enabled, the GMS server is added to the Event Profile 0 group in the Syslog Servers table. It cannot be added to any other Profile groups. Therefore, only the Profile 0 group can have 8 servers in total (7 Syslog servers and 1 GMS server). All other groups can have only 7 servers. The events in the GMS group in the Log > Settings page have Profile 0 and cannot be changed. Other events can have a different Profile. IPv6 Support In SonicOS , IPv6 is supported on a number of additional features, as shown in this section. SSL Control SonicOS introduces IPv6 support for SSL Control. No new options or settings have been added. Both IPv4 and IPv6 network traffic is inspected based on the settings in the Firewall Settings > SSL Control page. 18

19 IPv6 DPI SSL SonicOS introduces IPv6 support for DPI SSL. No new options or settings have been added. The settings on the DPI SSL > Client SSL and DPI SSL > Server SSL pages are now applied to both IPv4 and IPv6 network traffic. IPv6 NTP SonicOS introduces support for NTP servers with IPv6 domain names or IP addresses. Administrators can now add IPv6 NTP servers in the NTP Settings section of the System > Time page. IPv6 DNS SonicOS introduces IPv6 support for DNS. To communicate with an IPv6 DNS server, first go to Network > Interfaces and configure a WAN interface with an IPv6 address, either as a static IP or through DHCPv6. Then on the Network > DNS page, select the IPv6 radio button for View IP Version. The display changes to allow input of IPv6 DNS server addresses, which can be entered manually or obtained dynamically from the WAN zone. Select the Prefer IPv6 DNS Servers checkbox to make SonicOS send DNS requests to the IPv6 DNS servers first, and if that fails, send the request to the configured IPv4 DNS servers. The DNS Name Lookup diagnostic tool on the System > Diagnostics page can be used to test the DNS servers. All four DNS diagnostic tools in previous releases are now integrated into DNS Name Lookup. IPv6 MAC Address Object SonicOS introduces IPv6 support for MAC address objects. A MAC address object (AO) binds to the dynamic memory of host IP addresses. It is often used when defining access rules. To create an IPv6 MAC AO, go to the Network > Address Objects page and click Add. Then select MAC in the Type field and enter the IPv6 MAC address in the MAC Address field. The configuration is basically the same as for an IPv4 MAC AO; no new options or settings have been added for configuring an IPv6 MAC AO. IPv6 FQDN Address Object SonicOS introduces IPv6 support for FQDN address objects. First, configure an IPv6 DNS server on the Network > DNS page. See IPv6 DNS for more information about this configuration. To create an IPv6 FQDN AO, go to the Network > Address Objects page and click Add. Then select FQDN in the Type field and enter the IPv6 FQDN hostname in the FQDN Hostname field. The configuration is basically the same as for an IPv4 FQDN AO; no new options or settings have been added for configuring an IPv6 FQDN AO. DPI SSL Increased Connection Counts and Enhancements SonicOS increases the number of DPI SSL connections available on TZ500 Series and TZ600 appliances. In addition to the increase in connection counts, this feature provides the following enhancements for all platforms: Stability fixes related to race conditions Re design of the initialization sequence Caching (both Session cache and Spoof cache) enhancements and optimizations 19

20 Memory footprint reduction per connection leading to increased connection counts Open Authentication Social Login SonicOS introduces support for Open Authentication Social Login. Social Login Open Authentication (OAuth) Also known as social sign in, social login is a form of single sign on using existing information from a social networking service such as Facebook, Twitter, or Google Plus to sign into a third party website instead of creating a new login account specifically for that website. OAuth is an open standard for authorization. OAuth provides client applications a secure delegated access to server resources on behalf of a resource owner. It specifies a process for resource owners to authorize third party access to their server resources without sharing their credentials. OAuth Social Login is supported on SonicWall firewalls with internal wireless and SonicPoint, in the scope of wireless zone guest services. Wireless guest services are widely used in public WiFi hotspots and corporate WiFi for guests. Facebook, Twitter, and Google Plus are supported in SonicOS Within the SonicOS scope, social login is supported for wireless guests, not for SonicOS administrator login. NOTE: Read the Open Authentication Social Login guidance from FaceBook/Google/Twitter and SonicWall before enabling this feature. External Authentication Server Topology SonicOS Settings To enable social login in SonicOS: 1 Edit the WLAN zone and click the Guest Services tab. 2 Select the Enable Guest Services and Enable External Guest Authentication checkboxes. 3 Click Configure next to the Enable External Guest Authentication checkbox. 4 In the Social Network Login section on the General tab of the popup dialog, select the Social Network Login checkbox and then select one or more of the Facebook, Google, or Twitter checkboxes. 5 On the Auth Pages tab, enter the desired page name such as login.php in the Login Page field. 20

21 6 Click OK. SonicOS automatically creates the necessary pass network domains for allowing authentication process traffic between the authentication server and the user. The automatically added address object group is named Default Social Login Pass Group. This address object group is appended to the current configured pass networks, if any, or added into a new group named Social Login Pass Group. The Network > Address Objects page shows these entries. Facebook Settings SonicPoint Radius Accounting SonicOS introduces support for Radius Accounting on SonicWall firewalls with a connected SonicPoint ACe, ACi, or N2, in the scope of IEEE i Enterprise Authentication. Radius Accounting uses the RADIUS protocol to deliver accounting information from a Network Access Server (NAS, a SonicPoint in our case) to the Radius Accounting Server (RAS). The SonicOS administrator can use the accounting information to apply various billing rules on the Radius Accounting server side, based on session duration time or traffic load being transferred for each individual user. Radius Accounting is the process of collecting and storing the information contained in the following system messages: Accounting Start Accounting Stop 21

22 SonicOS Settings To configure Radius Accounting: 1 On the SonicPoint > SonicPoints page, click the Configure button for your SonicPoint. 2 Under Radius Server Settings, click Configure. 22

23 3 In the configuration dialog, enter the correct IP, Port, and Secret (password) for the Radius Accounting Server and Radius (Authentication) server. NOTE: The Radius Accounting Server and Radius (Authentication) Server do not need to be located at the same IP. 4 Click OK to provision the SonicPoint ACe/ACi/N2. Radius Server Settings The Radius Server needs to be configured accordingly to turn on accounting support. To configure freeradius fto turn on accounting support: 1 Add the Radius client entry into the file /etc/freeradius/clients.conf: Client { Secret= "password" } NOTE: is the WAN IP of the SonicWall Gateway from which the Radius Server can be reached. 2 Add the user information into the file /etc/freeradius/users: user_name Cleartext-Password := "password" 3 Run the command sudo freeradius -X in the terminal to start freeradius. 31 Bit Network SonicOS introduces support for RFC 3021, which defines the use of a 31 bit subnet mask. This mask allows only two host addresses in the subnet, with no network or gateway address and no broadcast address. Such a configuration can be used within a larger network to connect two hosts with a point to point link. The savings in address space resulting from this change is easily seen, each point to point link in a large network would consume two addresses instead of four. In this context, the point to point link is not equivalent to PPP (point to point protocol). The point to point link using a 31 bit mask can use or not use the PPP protocol. 31 bit prefixed IPv4 addresses on a point to point link can also be used in the Ethernet network. 23

24 Configuring SonicOS To configure an interface for a 31 bit subnet: 1 On the Network > Interfaces page, edit the desired interface. 2 Set the Subnet Mask to Enter one host IP address into the IP Address field. 4 Enter the other host IP address into the Default Gateway field. 5 Set the other fields according to your network, as needed. 6 Click OK. Example Network Environment In this network environment, Host PC1 and Host PC2 can use visit each other, while hosts in the LAN network can visit Host PC2. 24

25 To configure settings for this environment: 1 For Host PC1, add two route entries: Route add mask Route add mask For Host PC2, add two route entries: Route add mask Route add mask On the Cisco router (F0/0): interface fastethernet 0/0 ip address On the Cisco 2811, add one route entry:! ip route ! 5 On the firewall, add one route entry to enable the WAN zone data flow from X2 to X5, and X5 to X2: Any Any X2 Default Gateway X2 RESTful API SonicOS introduces support for a RESTful API. The SonicOS RESTful API provides API access to SonicWall firewall services. Compared with current firewall GUI/CLI user interfaces, the RESTful API is simple and makes good use of the standard HTTP protocol. With the trend toward cloud deployment, the RESTful API can more easily be used than the traditional SonicOS GUI/CLI. The key principles of REST involve separating the API into logical resources. These resources are manipulated using HTTP requests where the method (GET, POST, PUT, PATCH, and DELETE) has specific meaning. The SonicOS REST like API is our implementation which relies on the current ECLI system to do the final configuration. Using a one to one mapping from the API to GUI configuration and related ECLI commands allows the solution to work like the user is entering the related commands in the console. In the initial implementation, SonicWall partner Cyphort can use our RESTful API layer to allow the Cyphort system to act as a RESTful client and communicate with a SonicWall firewall. Currently Cyphort provides a detection only APT solution and is integrating with SonicWall firewalls to be able to push rules through the API such as, block all downloads coming from this URL. Biometric Authentication SonicOS introduces support for biometric authentication in conjunction with SonicWall Mobile Connect. Mobile Connect is an app that allows users to securely access private networks from a mobile device. Mobile Connect 4.0 supports using finger touch for authentication as a substitute for username and password. SonicOS provides configuration settings on the SSL VPN > Client Settings page to allow this method of authentication when using Mobile Connect to connect to the firewall. To enable biometric authentication: 1 On the SSL VPN > Client Settings page, click the Configure button for the Default Device Profile. 25

26 2 On the Client Settings tab, select Enabled for one or both of the following settings: Allow Touch ID on IOS devices Allow Fingerprint Authentication on Android devices 3 On the client smartphone or other mobile device, enable Touch ID (ios) or Fingerprint Authentication (Android). Ensure that Mobile Connect 4.0 or higher is installed on the mobile device, and configure it to connect with the firewall. EasyVPN SonicOS introduces the EasyVPN feature. This feature provides automatic VPN provisioning for box tobox hub and spoke configurations. The user experience is similar to that seen when using SonicWall Global VPN Client to connect from a client machine to a firewall, in which none of the complexity is visible to the user. Minimally, only two pieces of information are required to configure a spoke appliance doing EasyVPN: The peer gateway address or domain name The machine authentication credentials By selecting the Default Provisioning Key option, machine authentication credentials can be based on a default value known to all the appliances. To increase security, user level credentials may also be required. EasyVPN can be used when adding a VPN Policy in the VPN > Settings page. In the Add dialog under Security Policy, select either: SonicWall Auto Provisioning Client 26

27 SonicWall Auto Provisioning Server 4 Configure the other fields as needed. Resolved Issues This section provides a list of resolved issues in this release. Log Resolved issue The Analyzer Server format should be Default format just like GMS Networking Resolved issue A NAT64 policy is auto deleted after its priority is changed A MAC Address Object that disables the Multi homed host resolves IPv4 or IPv6 hosts incorrectly Traffic matching a NAT64 policy from a VLAN interface fails due to being dropped with the message, Packet on invalid VLAN. The traffic is unreachable when the MTU of a WAN interface is less 1500 and traffic is sent with packet size larger than the MTU but less than An Address Object type will become a host when editing a Network/Range type AO SonicPoint Resolved issue A SonicPoint ACe becomes non responsive after some time

28 Switching / X Series Resolved issue A configuration mismatch occurs between the firewall and switch after trying to PortShield a switch port to an appliance interface over a dedicated uplink when the interface has a VLAN configured that overlaps with a VLAN configured on the common uplink interface Overlapping VLANs can be configured under common uplinks of different switches In a deployment with High Availability plus Common uplink topology, traffic does not resume after failing over to the secondary firewall. Powering down an X1052 switch causes an unexpected failover Clicking the configure button for an unassigned firewall uplink interface opens the Add Zone popup window. System Resolved issue A custom added Network Monitor policy is spontaneously deleted after being modified VPN Resolved issue After switching from Tunnel Interface to Auto Provisioned Client Policy, the tunnel does not come up Wireless Resolved issue Wireless social login pass networks in guest service zone settings cannot be modified Issues Resolved in Previous Beta Releases The following issues were resolved in previous Beta firmware versions. 3G/4G Resolved issue A Sprint 341U card takes more than 10 minutes to connect. Occurs when the Sprint 341U is connected to U0, which is configured as the Final Backup with a 4G profile, and then failover from the Primary WAN (X1) is triggered by unplugging the cable from X Bandwidth Management Resolved issue An Advanced BWM policy works for egress traffic, but not for ingress traffic. Occurs when two SonicPoints are connected to the same firewall interface and Advanced BWM policies are configured for both egress and ingress traffic between wireless clients of the two SonicPoints

29 Networking Resolved issue There is no option to originate a default route for dynamic IPv6 routing via OSPFv3. Occurs when configuring OSPFv3 from the Network > Routing page. IPv6 default route origination via OSPFv3 is currently not supported SSL VPN Resolved issue NetExtender cannot establish a connection from a client machine to the firewall. Occurs when the SYN Flood Protection Mode option under Firewall Settings > Flood Protection is set to Always proxy WAN client connections Users Resolved issue RADIUS or LDAP authenticated user sessions remain active after clicking the Logout button. Occurs when a user on the LAN side attempts to access the Internet through the firewall and logs in when the login redirect window is displayed and then clicks the Logout button. When the Users > Status page is checked, the Active User Sessions table still shows the user session as active, and the user can continue to access the Internet from the same computer without being required to log in again Known Issues This section provides a list of known issues in this release. 3G/4G Known issue The Huawei E353 cannot connect High Availability Known issue It is not possible to force a failover, either with the method provided in the SonicOS UI or on the command line (CLI). Occurs when clicking the Force Active/Standby Failover button on the High Availability > Advanced page, or when trying the CLI command 'force failover' Default route is wrong in secondary unit when X1 is in DHCP mode Log Known issue On the Dashboard > Log Monitor page, the Select Columns to Display option does not work and Log Monitor displays a csrftoken missing error whenever any new column is selected and the Apply or Restore Default buttons are clicked. The log message shows an incorrect application type of General ICMP when a web site is allowed by CFS

30 Networking Known issue A newly added FQDN PBR route has a higher priority value than the default route when its metric >=20; it should have a lower priority than the default route. The firewall does not handle traffic correctly due to many missing NAT policies. Occurs after upgrading the beta firmware from SonicoS n to n SonicPoint Known issue RADIUS Accounting fails with a SonicPoint NDR Access Point Switching / X Series Known issue The parent interface of an interface already configured for port redundancy or link aggregation can incorrectly be configured as a firewall uplink. Re adding a switch after deleting it throws an error and the switch becomes inaccessible System Known issue The new combined DNS Name Lookup diagnostic tool does not perform NetBIOS lookup. It should include this functionality which was previously provided by the Reverse Name Resolution tool, which is removed from System > Diagnostics tools in SonicOS VPN Known issue Phase 2 re negotiation fails with IKE Responder: IPsec proposal does not match (Phase 2) after HA failover occurs and phase 2 lifetime expires. Occurs after an AP connection is established, then an HA failover occurs, and then the phase2 lifetime expires The Tunnel cannot be negotiated if Auto Provisioned Server uses a certificate with a wildcard System Compatibility This section provides additional information about hardware and software compatibility with this release. Wireless 3G/4G Broadband Devices SonicOS provides support for a wide variety of PC cards, USB devices and wireless service providers. For the most recent list of supported devices, see wireless broadband cardsdevices/. 30

31 GMS Support SonicWall Global Management System (GMS) management of SonicWall security appliances running SonicOS requires GMS 8.3 for management of firewalls using the new features in SonicOS GMS 8.2 supports management of all other features in SonicOS and earlier releases. WXA Support The SonicWall WXA series appliances (WXA 6000 Software, WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are supported for use with SonicWall security appliances running SonicOS The recommended firmware version for the WXA series appliances is WXA Browser Support SonicOS with Visualization uses advanced browser technologies such as HTML5, which are supported in most recent browsers. SonicWall recommends using the latest Chrome, Firefox, Internet Explorer, or Safari browsers for administration of SonicOS. This release supports the following Web browsers: Chrome 18.0 and higher (recommended browser for dashboard real time graphics display) Firefox 16.0 and higher Internet Explorer 9.0 and higher Safari 5.0 and higher running on non Windows machines NOTE: On Windows machines, Safari is not supported for SonicOS management. NOTE: Mobile device browsers are not recommended for SonicWall appliance system administration. Product Licensing SonicWall network security appliances must be registered on MySonicWall to enable full functionality and the benefits of SonicWall security services, firmware updates, and technical support. Log in or register for a MySonicWall account at Upgrading Information For information about obtaining the latest firmware, upgrading the firmware image on your SonicWall appliance, and importing configuration settings from another appliance, see the SonicOS 6.2 Upgrade Guide available on MySonicWall at or on the Support portal at 31

32 SonicWall Support Technical support is available to customers who have purchased SonicWall products with a valid support maintenance contract and to customers who have trial versions. The Support Portal provides self help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. To access the Support Portal, go to The Support Portal enables you to: View knowledge base articles and technical documentation Download software View video tutorials Collaborate with peers and experts in user forums Get licensing assistance Access MySonicWall Learn about SonicWall professional services Register for training and certification To contact SonicWall Support, visit support. 32